post-exploiting-microsoft-graph-with-graphrunner

Fail

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Downloads an offensive toolset from an external repository (https://github.com/dafthack/GraphRunner.git) that is not listed as a trusted vendor.
  • [REMOTE_CODE_EXECUTION]: Instructs the user to import and execute the downloaded PowerShell module (GraphRunner.ps1), which results in the execution of code from an unverified third-party source.
  • [DATA_EXFILTRATION]: Automates the searching and extraction of sensitive data from Microsoft 365 services, including mailbox content, SharePoint files, and Teams chats (e.g., Invoke-SearchMailbox, Invoke-SearchSharePointAndOneDrive).
  • [DATA_EXFILTRATION]: Provides explicit instructions to configure persistence through hidden inbox forwarding rules that exfiltrate data to an external email address (attacker@evil.com).
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection within scripts/agent.py through the following evidence chain:
  • Ingestion points: Data is ingested from the Microsoft Graph API via /users, /groups, and /me/messages endpoints in scripts/agent.py.
  • Boundary markers: No delimiters or instructions to ignore embedded content are used when processing API responses.
  • Capability inventory: The skill has the capability to execute shell commands (SKILL.md workflow) and perform network operations (scripts/agent.py calls to Graph API).
  • Sanitization: API response data (such as email subjects or user attributes) is printed or written to files without sanitization or validation.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 4, 2026, 02:40 PM
Security Audit — agent-trust-hub — post-exploiting-microsoft-graph-with-graphrunner